aerc-accounts

package: aerc

title: aerc-accounts(5)

text:
# aerc-accounts(5)

## NAME
aerc-accounts - account configuration file format for aerc(1)

## SYNOPSIS
The accounts.conf file is used for configuring each mail account used for aerc. It is expected to be in your XDG config home plus aerc, which defaults to ~/.config/aerc/accounts.conf. This file must be kept secret, as it may include your account credentials.

If accounts.conf does not exist, the :new-account configuration wizard will be executed automatically on first startup.

This file is written in the ini format where each [section] is the name of an account you want to configure, and the keys & values in that section specify details of that account's configuration. In addition to the options documented here, specific transports for incoming and outgoing emails may have additional configuration parameters, documented on their respective man pages.

## CONFIGURATION
Note that many of these configuration options are written for you, such as source and outgoing, when you run the account configuration wizard (:new-account).

archive = <folder>

Specifies a folder to use as the destination of the :archive command. Default: Archive

check-mail = <duration>

Specifies an interval to check for new mail. Mail will be checked at startup, and every interval. IMAP accounts will check for mail in all unselected folders, and the selected folder will continue to receive PUSH mail notifications. Maildir/Notmuch folders must use check-mail-cmd in conjunction with this option. See aerc-maildir(5) and aerc-notmuch(5) for more information. Setting this option to 0 will disable check-mail

Example:

check-mail = 5m

Default: 0

copy-to = <folder>

Specifies a folder to copy sent mails to, usually Sent.

default = <folder>

Specifies the default folder to open in the message list when aerc configures this account. Default: INBOX

folders = <folder1,folder2,folder3...>

Specifies the comma separated list of folders to display in the sidebar. Names prefixed with ~ are interpreted as regular expressions. By default, all folders are displayed.

folders-exclude = <folder1,folder2,folder3...>

Specifies the comma separated list of folders to exclude from the sidebar. Names prefixed with ~ are interpreted as regular expressions. Note that this overrides anything from folders. By default, no folders are excluded.

enable-folders-sort = true|false

If true, folders are sorted, first by specified folders (see folders-sort), then alphabetically. Default: true

folders-sort = <folder1,folder2,folder3...>

Specifies a comma separated list of folders to be shown at the top of the list in the provided order. Remaining folders will be sorted alphabetically.

from = <address>

The default value to use for the From header in new emails. This should be an RFC 5322-compatible string, such as Your Name <you@example.org>.

aliases = <address1,address2,address3...>

All aliases of the current account. These will be used to fill in the From: field. Make sure that your email server accepts this value, or for example use aerc-sendmail(5) in combination with msmtp(1) and --read-envelope-from.

outgoing = <uri>

Specifies the transport for sending outgoing emails on this account. It should be a connection string, and the specific meaning of each component varies depending on the protocol in use. See each protocol's man page for more details:

•aerc-sendmail(5)

•aerc-smtp(5)

outgoing-cred-cmd = <command>

Specifies an optional command that is run to get the outgoing account's password. See each protocol's man page for more details.

outgoing-cred-cmd-cache = true|false

By default, the credentials returned by the command will be cached until aerc is shut down. If set to false, outgoing-cred-cmd will be executed every time an email is to be sent. Default: true

pgp-auto-sign = true|false

If true, all outgoing emails from this account will be signed (if a signing key is available). Default: false

pgp-error-level = none|warn|error

The level of error to display when opportunistic encryption cannot be performed. See pgp-opportunistic-encryption. Default: warn

pgp-key-id = <key-id>

Specify the key id to use when signing a message. Can be either short or long key id. If unset, aerc will look up the key by email.

pgp-opportunistic-encrypt = true|false

If true, any outgoing email from this account will be encrypted when all recipients (including Cc and Bcc field) have a public key available in the keyring. The level of error to display when a message can't be encrypted can be configured with pgp-error-level. Default: false

postpone = <folder>

Specifies the folder to save postponed messages to. Default: Drafts

send-as-utc = true|false

Converts the timestamp of the Date header to UTC. Default: false

source = <uri>

Specifies the source for reading incoming emails on this account. This key is required for all accounts. It should be a connection string, and the specific meaning of each component varies depending on the protocol in use. See each protocol's man page for more details:

•aerc-imap(5)

•aerc-maildir(5)

•aerc-notmuch(5)

source-cred-cmd = <command>

Specifies an optional command that is run to get the source account's password. See each protocol's man page for more details.

signature-file = <path>

Specifies the file to read in order to obtain the signature to be added to emails sent from this account. Please note that by convention the Usenet signature style of two dashes, followed by a space ("-- ") should be placed at the top of the signature to separate content and signature. Aerc will add that delimiter if it is not already present.

signature-cmd = <command>

Specifies the command to execute with sh -c in order to obtain the signature to be added to emails sent from this account. If the command fails then signature-file is used instead.

trusted-authres = <host1,host2,host3...>

Comma-separated list of trustworthy hostnames from which the Authentication Results header will be displayed. Entries can be regular expressions. If you want to trust any host (e.g. for debugging), use the wildcard *.

subject-re-pattern = <regexp>

When replying to a message, this is the regular expression that will be used to match the prefix of the original message's subject that has to be removed, to create the subject line of the new message. Typically, this will be used to avoid a repetition of the Re: prefix in the subject header. The default will match known translations for the common Re:. Default: (?i)^((AW|RE|SV|VS|ODP|R): ?)+

## SEE ALSO
aerc(1) aerc-config(5) aerc-imap(5) aerc-maildir(5) aerc-notmuch(5) aerc-sendmail(5) aerc-smtp(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-binds

title: aerc-binds(5)

text:
# aerc-binds(5)

## NAME
aerc-binds - key bindings configuration file format for aerc(1)

## SYNOPSIS
The binds.conf file is used for configuring keybindings used in the aerc interactive client. It is expected to be in your XDG config home plus aerc, which defaults to ~/.config/aerc/binds.conf. If the file does not exist, the built-in default will be installed.

This file is written in the ini format with key bindings defined as:

<key sequence> = <command>

Where <key sequence> is the keystrokes pressed (in order) to invoke this keybinding, and <command> specifies keystrokes that aerc will simulate when the keybinding is invoked. Generally this is used to execute commands, for example:

rq = :reply -q<Enter>

Pressing r, then q, will simulate typing in :reply -q<Enter>, and execute :reply -q accordingly. It is also possible to invoke keybindings recursively in a similar fashion.

You may configure different keybindings for different contexts by writing them into different [sections] of the ini file.

## CONTEXTS
The available contexts are:

[messages]

keybindings for the message list

[view]

keybindings for the message viewer

[view::passthrough]

keybindings for the viewer, when in key passthrough mode (toggled with :toggle-key-passthrough)

[compose]

keybindings for the message composer

[compose::editor]

keybindings for the composer, when the editor is focused

[compose::review]

keybindings for the composer, when reviewing the email before it's sent

[terminal]

keybindings for terminal tabs

You may also configure account specific key bindings for each context:

[context:account=AccountName]

keybindings for this context and account, where AccountName matches the account name you provided in accounts.conf.

Folder-specific bindings can be configured for message lists:

[messages:folder=FolderName]

keybindings under this section will be specific to the folder named FolderName. Keybindings from a folder specifier will take precedence over account specifiers

Example:

```
[messages:account=Mailbox]
c = :cf path:mailbox/** and<space>
[compose::editor:account=Mailbox2]
[messages:folder=Drafts]
<Enter> = :recall<Enter>
...
```

You may also configure global keybindings by placing them at the beginning of the file, before specifying any context-specific sections.

## SPECIAL OPTIONS
In addition of user defined key sequences, the following special options are available in each binding context:

$noinherit = true|false

If set to true, global keybindings will not be effective in this context. Default: false

$ex = <key-stroke>

This can be set to a keystroke which will bring up the command input in this context. Default: :

## SUPPORTED KEYS
In addition to letters and some characters (e.g. a, RR, gu, ?, !, etc.), special keys may be specified in <angle brackets>. The following special keys are supported:

Name

Description

<space>

" "

<semicolon>

;

<tab>

Tab

<enter>

Enter

<up>

Up arrow

<c-up>

Ctrl+Up

<a-up>

Alt+Up

<down>

Down arrow

<c-down>

Ctrl+Down

<a-down>

Alt+Down

<right>

Right arrow

<c-right>

Ctrl+Right

<a-right>

Alt+Right

<left>

Left arrow

<c-left>

Ctrl+Left

<a-left>

Alt+Left

<pgup>

Page Up

<c-pgup>

Ctrl+PageUp

<a-pgup>

Alt+PageUp

<pgdn>

Page Down

<c-pgdn>

Ctrl+PageDn

<a-pgdn>

Alt+PageDn

<home>

Home

<end>

End

<insert>

Insert

<delete>

Delete

<exit>

Exit

<cancel>

Cancel

<print>

Print screen

<pause>

Pause

<backtab>

Shift+Tab

<c-space>

Ctrl+Space

<a-space>

Alt+Space

<c-a>

Ctrl+a

<a-a>

Alt+a

<c-b>

Ctrl+b

<a-b>

Alt+b

<c-c>

Ctrl+c

<a-c>

Alt+c

<c-d>

Ctrl+d

<a-d>

Alt+d

<c-e>

Ctrl+e

<a-e>

Alt+e

<c-f>

Ctrl+f

<a-f>

Alt+f

<c-g>

Ctrl+g

<a-g>

Alt+g

<c-h>

Ctrl+h

<a-h>

Alt+h

<c-i>

Ctrl+i

<a-i>

Alt+i

<c-j>

Ctrl+j

<a-j>

Alt+j

<c-k>

Ctrl+k

<a-k>

Alt+k

<c-l>

Ctrl+l

<a-l>

Alt+l

<c-m>

Ctrl+m

<a-m>

Alt+m

<c-n>

Ctrl+n

<a-n>

Alt+n

<c-o>

Ctrl+o

<a-o>

Alt+o

<c-p>

Ctrl+p

<a-p>

Alt+p

<c-q>

Ctrl+q

<a-q>

Alt+q

<c-r>

Ctrl+r

<a-r>

Alt+r

<c-s>

Ctrl+s

<a-s>

Alt+s

<c-t>

Ctrl+t

<a-t>

Alt+t

<c-u>

Ctrl+u

<a-u>

Alt+u

<c-v>

Ctrl+v

<a-v>

Alt+v

<c-w>

Ctrl+w

<a-w>

Alt+w

<c-x>

Ctrl+x

<a-x>

Alt+x

<c-y>

Ctrl+y

<a-y>

Alt+y

<c-z>

Ctrl+z

<a-z>

Alt+z

<c-]>

Ctrl+]

<a-]>

Alt+]

<c-[>

Ctrl+[

<a-[>

Alt+[

<c-^>

Ctrl+^

<a-^>

Alt+^

<c-_>

Ctrl+_

<a-_>

Alt+_

## SEE ALSO
aerc(1) aerc-config(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-config

title: aerc-config(5)

text:
# aerc-config(5)

## NAME
aerc-config - configuration file format for aerc(1)

## SYNOPSIS
There are three aerc config files: aerc.conf, binds.conf, and accounts.conf. The last one must be kept secret, as it may include your account credentials. We look for these files in your XDG config home plus aerc, which defaults to ~/.config/aerc.

Examples of these config files are typically included with your installation of aerc and are usually installed in /usr/share/aerc.

Each file uses the ini format, and consists of sections with keys and values. A line beginning with # is considered a comment and ignored, as are empty lines. New sections begin with [section-name] on a single line, and keys and values are separated with =.

This manual page focuses on aerc.conf. binds.conf is detailed in aerc-binds(5) and accounts.conf in aerc-accounts(5).

aerc.conf is used for configuring the general appearance and behavior of aerc.

## GENERAL OPTIONS
These options are configured in the [general] section of aerc.conf.

default-save-path = <path>

Used as a default path for save operations if no other path is specified.

pgp-provider = auto|gpg|internal

If set to gpg, aerc will use system gpg binary and keystore for all crypto operations. If set to internal, the internal openpgp keyring will be used. If set to auto, the system gpg will be preferred unless the internal keyring already exists, in which case the latter will be used. Default: auto

unsafe-accounts-conf = true|false

By default, the file permissions of accounts.conf must be restrictive and only allow reading by the file owner (0600). Set this option to true to ignore this permission check. Use this with care as it may expose your credentials. Default: false

log-file = <path>

Output log messages to specified file. A path starting with ~/ is expanded to the user home dir. When redirecting aerc's output to a file using > shell redirection, this setting is ignored and log messages are printed to stdout.

log-level = trace|debug|info|warn|error

Only log messages above the specified level to log-file. Supported levels are: trace, debug, info, warn and error. When redirecting aerc's output to a file using > shell redirection, this setting is ignored and the log level is forced to trace. Default: info

disable-ipc = true|false

Disable the execution of commands over IPC. Default: false

term = <TERM>

Set the $TERM environment variable used for the embedded terminal. Default: xterm-256color

enable-osc8 = true_|false

Enable the embedded terminal to output OSC 8 (hyperlinks) escape sequences. Not all terminal emulators handle OSC 8 sequences properly and can produce confusing results, disable this setting if that occurs. Default: false

## UI OPTIONS
These options are configured in the [ui] section of aerc.conf.

index-columns = <column1,column2,column3...>

Describes the format for each row in a mailbox view. This is a comma separated list of column names with an optional align and width suffix. After the column name, one of the < (left), : (center) or > (right) alignment characters can be added (by default, left) followed by an optional width specifier. The width is either an integer representing a fixed number of characters, or a percentage between 1% and 99% representing a fraction of the terminal width. It can also be one of the * (auto) or = (fit) special width specifiers. Auto width columns will be equally attributed the remaining terminal width. Fit width columns take the width of their contents. If no width specifier is set, * is used by default. Default: date<20,name<17,flags>4,subject<*

column-separator = "<separator>"

String separator inserted between columns. When a column width specifier is an exact number of characters, the separator is added to it (i.e. the exact width will be fully available for that column contents). Default: " "

column-<name> = <go template>

Each name in index-columns must have a corresponding column-<name> setting. All column-<name> settings accept golang text/template syntax. By default, these columns are defined:

```
column-date = {{.DateAutoFormat .Date.Local}}
column-name = {{index (.From | names) 0}}
column-flags = {{.Flags | join ""}}
column-subject = {{.Subject}}
```

See aerc-templates(7) for all available symbols and functions.

timestamp-format = <timeformat>

See time.Time#Format at https://godoc.org/time#Time.Format Default: 2006-01-02 03:04 PM (ISO 8601 + 12 hour time)

this-day-time-format = <timeformat>

Index-only time format for messages that were received/sent today. If this is not specified, timestamp-format is used instead.

this-week-time-format = <timeformat>

Index-only time format for messages that were received/sent within the last 7 days. If this is not specified, timestamp-format is used instead.

this-year-time-format = <timeformat>

Index-only time format for messages that were received/sent this year. If this is not specified, timestamp-format is used instead.

message-view-timestamp-format = <timeformat>

If set, overrides timestamp-format for the message view.

message-view-this-day-time-format = <timeformat>

If set, overrides timestamp-format in the message view for messages that were received/sent today.

message-view-this-week-time-format = <timeformat>

If set, overrides timestamp-format in the message view for messages that were recieved/sent within the last 7 days.

message-view-this-year-time-format = <timeformat>

If set, overrides timestamp-format in the message view for messages that were received/sent this year.

sidebar-width = <int>

Width of the sidebar, including the border. Set to zero to disable the sidebar. Default: 20

empty-message = <string>

Message to display when viewing an empty folder. Default: (no messages)

empty-dirlist = <string>

Message to display when no folders exists or are all filtered. Default: (no folders)

mouse-enabled = true|false

Enable mouse events in the ui, e.g. clicking and scrolling with the mousewheel Default: false

new-message-bell = true|false

Ring the bell when a new message is received. Default: true

tab-title-account = <go_template>

The template to use for account tab titles. See aerc-templates(7) for available field names. To conditionally show the unread count next to the account name, set to:

tab-title-account = {{.Account}} {{if .Unread}}({{.Unread}}){{end}}

Default: {{.Account}}

tab-title-composer = <go_template>

The template to use for composer tab titles. See aerc-templates(7) for available field names. Default: {{.Subject}}

pinned-tab-marker = "<string>"

Marker to show before a pinned tab's name. Default: `

spinner = "<string>"

Animation shown while loading, split by spinner-delimiter (below) Examples:

•spinner = "-_-,_-_"

•spinner = '. , .'

•spinner = ",|,/,-"

Default: "[..] , [..] , [..] , [..] , [..], [..] , [..] , [..] "

spinner-delimiter = <string>

Spinner delimiter to split string into an animation Default: ,

spinner-interval = <duration>

The delay between each spinner frame Default: 200ms

sort = <criteria>

List of space-separated criteria to sort the messages by, see :sort command in aerc(1) for reference. Prefixing a criterion with -r reverses that criterion. Example:

sort = from -r date

dirlist-left = <go template>

Template for the left side of the directory list. See aerc-templates(7) for all available fields and functions. Default: {{.Folder}}

dirlist-right = <go template>

Template for the right side of the directory list. See aerc-templates(7) for all available fields and functions. Default: {{if .Unread}}{{humanReadable .Unread}}/{{end}}{{if .Exists}}{{humanReadable .Exists}}{{end}}

dirlist-delay = <duration>

Delay after which the messages are actually listed when entering a directory. This avoids loading messages when skipping over folders and makes the UI more responsive. If you do not want that, set it to 0s. Default: 200ms

dirlist-tree = true|false

Display the directory list as a foldable tree. Default: false

dirlist-collapse = <int>

If dirlist-tree is enabled, set level at which folders are collapsed by default. Set to 0 to disable. Default: 0

next-message-on-delete = true|false

Moves to next message when the current message is deleted, archived, or moved. Default: true

auto-mark-read = true|false

Set the seen flag when a message is opened in the message viewer. Default: true

completion-popovers = true|false

Shows potential auto-completions for text inputs in popovers. Default: true

completion-delay = <duration>

How long to wait after the last input before auto-completion is triggered. Default: 250ms

completion-min-chars = <int>

The minimum required characters to allow auto-completion to be triggered after completion-delay. Default: 1

border-char-vertical = "<char>"

border-char-horizontal = "<char>"

Set stylable characters (via the border element) for vertical and horizontal borders. Default: " "

stylesets-dirs = <path1:path2:path3...>

The directories where the stylesets are stored. The config takes a colon-separated list of dirs. If this is unset or if a styleset cannot be found, the following paths will be used as a fallback in that order:

```
${XDG_CONFIG_HOME:-~/.config}/aerc/stylesets
${XDG_DATA_HOME:-~/.local/share}/aerc/stylesets
/usr/local/share/aerc/stylesets
/usr/share/aerc/stylesets
```

styleset-name = <string>

The name of the styleset to be used to style the ui elements. The stylesets are stored in the stylesets directory in the config directory. Default: default

Have a look at aerc-stylesets(7) as to how a styleset looks like.

icon-unencrypted = <string>

The icon to display for unencrypted mails. The status indicator is only displayed if an icon is set.

icon-encrypted = <string>

The icon to display for encrypted mails. Default: [e]

icon-signed = <string>

The icon to display for signed mails where the signature was successfully validated. Default: [s]

icon-signed-encrypted = <string>

The icon to display for signed and encrypted mails where the signature was successfully verified. The combined icon is only used if set, otherwise the signed and encrypted icons are displayed separately.

icon-unknown = <string>

The icon to display for signed mails which could not be verified due to the key being unknown. Default: [s?]

icon-invalid = <string>

The icon to display for signed mails where verification failed. Default: [s!]

icon-attachment = <string>

The icon to display index-format when the message has an attachment. Default: a

fuzzy-complete = true|false

When typing a command or option, the popover will now show not only the items /starting/ with the string input by the user, but it will also show instances of items /containing/ the string, starting at any position and need not be consecutive characters in the command or option.

reverse-msglist-order = true|false

Reverses the order of the message list. By default, the message list is ordered with the newest (highest UID) message on top. Reversing the order will put the oldest (lowest UID) message on top. This can be useful in cases where the backend does not support sorting. Default: false

reverse-thread-order = true|false

Reverse display of the message threads. By default, the thread root is displayed at the top of the tree with all replies below. The reverse option will put the thread root at the bottom with replies on top. Default: false

sort-thread-siblings = true|false

Sort the thread siblings according to the sort criteria for the messages. If sort-thread-siblings is false, the thread siblings will be sorted based on the message UID. This option is only applicable for client-side threading with a backend that enables sorting. Default: false

threading-enabled = true|false

Enable a threaded view of messages. If this is not supported by the backend (IMAP server or notmuch), threads will be built by the client. Default: false

force-client-threads = true|false

Force threads to be built client-side. Backends that don't support threading will always build threads client side. Default: false

### CONTEXTUAL UI CONFIGURATION
The UI configuration can be specialized for accounts, specific mail directories and message subjects. The specializations are added using contextual config sections based on the context.

The contextual UI configuration is merged to the base UiConfig in the following order: Base UIConfig > Account Context > Folder Context.

[ui:account=AccountName]

Adds account specific configuration with the account name.

[ui:folder=FolderName]

Add folder specific configuration with the folder name.

[ui:folder~Regex]

Add folder specific configuration for folders whose names match the regular expression.

Example:

```
[ui:account=Work]
sidebar-width=...
[ui:folder=Sent]
index-format=...
[ui:folder~Archive/d+/.*]
index-format=...
```

## STATUSLINE
These options are configured in the [statusline] section of aerc.conf.

status-columns = <column1,column2,column3...>

Describes the format for the statusline. This is a comma separated list of column names with an optional align and width suffix. See [ui].index-columns for more details. To completely mute the statusline (except for push notifications), explicitly set status-columns to an empty string:

status-columns=

Default: left<*,center>=,right>*

column-separator = "<separator>"

String separator inserted between columns. See [ui].column-separator for more details. Default: " "

column-<name> = <go template>

Each name in status-columns must have a corresponding column-<name> setting. All column-<name> settings accept golang text/template syntax. By default, these columns are defined:

```
column-left = [{{.Account}}] {{.StatusInfo}}
column-center = {{.PendingKeys}}
column-right = {{.TrayInfo}}
```

See aerc-templates(7) for all available symbols and functions.

separator = "<string>"

Specifies the separator between grouped statusline elements (e.g. for the {{.ContentInfo}}, {{.TrayInfo}} and {{.StatusInfo}} in column-<name>). Default: " | "

display-mode = text|icon

Defines the mode for displaying the status elements. Default: text

## VIEWER
These options are configured in the [viewer] section of aerc.conf.

pager = <command>

Specifies the pager to use when displaying emails. Note that some filters may add ANSI escape sequences to add color to rendered emails, so you may want to use a pager which supports ANSI. Default: less -R

alternatives = <mime,types>

If an email offers several versions (multipart), you can configure which mimetype to prefer. For example, this can be used to prefer plaintext over HTML emails. Default: text/plain,text/html

header-layout = <header|layout,list...>

Defines the default headers to display when viewing a message. To display multiple headers in the same row, separate them with a pipe, e.g. From|To. Rows will be hidden if none of their specified headers are present in the message. Notmuch tags can be displayed by adding Labels.

Authentication information from the Authentication-Results header can be displayed by adding DKIM, SPF or DMARC. To show more information than just the authentication result, append a plus sign (+) to the header name (e.g. DKIM+).

Default: From|To,Cc|Bcc,Date,Subject

show-headers = true|false

Default setting to determine whether to show full headers or only parsed ones in message viewer. Default: false

always-show-mime = true|false

Whether to always show the mimetype of an email, even when it is just a single part. Default: false

parse-http-links = true|false

Parses and extracts http links when viewing a message. Links can then be accessed with the open-link command. Default: true

## COMPOSE
These options are configured in the [compose] section of aerc.conf.

editor = <command>

Specifies the command to run the editor with. It will be shown in an embedded terminal, though it may also launch a graphical window if the environment supports it. Defaults to $EDITOR, or vi(1).

header-layout = <header|layout,list...>

Defines the default headers to display when composing a message. To display multiple headers in the same row, separate them with a pipe, e.g. To|From. Default: To|From,Subject

address-book-cmd = <command>

Specifies the command to be used to tab-complete email addresses. Any occurrence of %s in the address-book-cmd will be replaced with anything the user has typed after the last comma. The command must output the completions to standard output, one completion per line. Each line must be tab-delimited, with an email address occurring as the first field. Only the email address field is required. The second field, if present, will be treated as the contact name. Additional fields are ignored.

This parameter can also be set per account in accounts.conf.

Example:

address-book-cmd = khard email --remove-first-line --parsable %s

file-picker-cmd = <command>

Specifies the command to be used to select attachments. Any occurrence of %s in the file-picker-cmd will be replaced with the argument <arg> to :attach -m <arg>. The command must output the selected files to standard output, one file per line.

Example:

file-picker-cmd = fzf --multi --query=%s

reply-to-self = true|false

If set to false, do not mail yourself when replying (e.g., if replying to emails previously sent by yourself, address your replies to the original To and Cc). Default: true

no-attachment-warning = <regexp>

Specifies a regular expression against which an email's body should be tested before sending an email with no attachment. If the regexp matches, aerc will warn you before sending the message. Leave empty to disable this feature. Uses Go's regexp syntax, documented at https://golang.org/s/re2syntax. The (?im) flags are set by default (case-insensitive and multi-line).

Example:

no-attachment-warning = ^[^>]*attach(ed|ment)

format-flowed = true|false

When set, aerc will generate Format=Flowed bodies with a content type of "text/plain; Format=Flowed" as described in RFC3676. This format is easier to handle for some mailing software, and generally just looks like ordinary text. To actually make use of this format's features, you'll need support in your editor. Default: false

## MULTIPART CONVERTERS
Converters allow generating multipart/alternative messages by converting the main text/plain body into any other text MIME type with the :multipart command. Only exact MIME types are accepted. The commands are invoked with sh -c and are expected to output valid UTF-8 text.

Only text/<subtype> MIME parts can be generated. The text/plain MIME type is reserved and cannot be generated. You still need to write your emails by hand in your favorite text editor.

Converters are configured in the [multipart-converters] section of aerc.conf.

Example:

```
[multipart-converters]
text/html=pandoc -f markdown -t html --standalone
```

Obviously, this requires that you write your main text/plain body using the markdown syntax. Also, mind that some mailing lists reject emails that contain text/html alternative parts. Use this feature carefully and when possible, avoid using it at all.

## FILTERS
Filters are a flexible and powerful way of handling viewing parts of an opened message. When viewing messages aerc will show the list of available message parts and their MIME type at the bottom, but unless a filter is defined for a specific MIME type, it will only show a menu with a few options (allowing you to open the part in an external program, save it to disk or pipe it to a shell command). Configuring a filter will allow viewing the output of the filter in the configured pager in aerc's built-in terminal.

Filters are configured in the [filters] section of aerc.conf. The first filter which matches the part's MIME type will be used, so order them from most to least specific. You can also match on non-MIME types, by prefixing with the header to match against (non-case-sensitive) and a comma, e.g. subject,text will match a subject which contains text. Use header,~regex to match against a regex.

Note that aerc will pipe the content into the configured filter program, so filters need to be able to read from standard input. Many programs support reading from stdin by putting - instead of a path to a file. You can also chain together multiple filters by piping with |.

aerc ships with some default filters installed in the libexec directory (usually /usr/libexec/aerc/filters). Note that these may have additional dependencies that aerc does not have alone.

The filter commands are invoked with sh -c command. The following folders are appended to the system $PATH to allow referencing filters from their name only.

```
${XDG_CONFIG_HOME:-~/.config}/aerc/filters
~/.local/libexec/aerc/filters
${XDG_DATA_HOME:-~/.local/share}/aerc/filters
$PREFIX/libexec/aerc/filters
$PREFIX/share/aerc/filters
/usr/libexec/aerc/filters
/usr/share/aerc/filters
```

The following variables are defined in the filter command environment:

AERC_MIME_TYPE

the part MIME type/subtype

AERC_FORMAT the part content type format= parameter (e.g. format=flowed)

AERC_FILENAME the attachment filename (if any)

AERC_SUBJECT the message Subject header value

AERC_FROM the message From header value

Note that said email body is converted into UTF-8 before being passed to filters.

If show-headers is enabled, only the currently viewed part body is piped into the filter command. A special .headers filter command can be defined to post process the full headers.

### EXAMPLES
text/plain

Color some things, e.g. quotes, git diffs, links, etc.:

```
text/plain=colorize
```

The built-in colorize filter can be configured in the [viewer] section of styleset files. See aerc-stylesets(7).

Wrap long lines at 100 characters, while not messing up nested quotes. Handles format=flowed emails properly:

```
text/plain=wrap -w 100 | colorize
```

from,<sender>

Another example of hard wrapping lines of emails sent by a specific person. Explicitly reflow all paragraphs instead of only wrapping long lines. This may break manual formatting in some messages:

```
from,thatguywhoneverhardwrapshismessages=wrap -r -w 72 | colorize
```

subject,~<regexp>

Use rainbow coloring with lolcat(1) for emails sent by software forges:

```
subject,~Git(hub|lab)=lolcat -f
```

text/html

Render html to a more human readable version and colorize:

```
text/html=html | colorize
```

Use pandoc to output plain text:

```
text/html=pandoc -f html -t plain
```

text/calendar

Parse calendar invites:

```
text/calendar=calendar
```

text/*

Catch any other type of text that did not have a specific filter and use bat(1) to color these:

```
text/*=bat -fP --file-name="$AERC_FILENAME" --style=plain
```

.headers

Colorize email headers when show-headers is true.

```
.headers=colorize
```

message/delivery-status

When not being able to deliver the provider might send such emails:

```
message/delivery-status=colorize
```

message/rfc822

When getting emails as attachments, e.g. on some mailing lists digest format is sending an email with all the digest emails as attachments. Requires caeml(1) to be on PATH:

```
message/rfc822=caeml | colorize
```

https://github.com/ferdinandyb/caeml

application/mbox

Emails as attachments in the mbox format. For example aerc can also create an mbox from messages with the :pipe command. Requires catbox(1) and caeml(1) to be on PATH:

```
application/mbox=catbox -c caeml | colorize
```

https://github.com/konimarti/catbox

application/pdf

Render pdf to text and rewrap at 100 character width. Requires pdftotext(1) to be on PATH:

```
application/pdf=pdftotext - -l 10 -nopgbrk -q  - | fmt -w 100
```

https://www.xpdfreader.com/pdftotext-man.html

image/*

This is a tricky topic. It's possible to display images in a terminal, but for high resolution images the terminal you are using either needs to support sixels or the kitty terminal graphics protocol. Unfortunately, aerc's built-in terminal supports neither, so only highly pixelated images can be shown natively. A workaround is possible by asking the terminal to draw on top of aerc and then remove the image when done viewing. The built-in terminal can show pixelated images with catimg(1):

```
image/*=catimg -w$(tput cols) -
```

See the wiki at https://man.sr.ht/~rjarry/aerc/ for more examples and possible customizations of the built-in filters.

## OPENERS
Openers allow you to specify the command to use for the :open and :open-link actions on a per-MIME-type basis. The :open-link URL scheme is used to determine the MIME type as follows: x-scheme-handler/<scheme>. They are configured in the [openers] section of aerc.conf.

{} is expanded as the temporary filename or URL to be opened. If it is not encountered in the command, the filename/URL will be appened to the end of the command. Environment variables are also expanded. Tilde is not expanded.

Like [filters], openers support basic shell globbing. The first opener which matches the part's MIME type (or URL scheme handler MIME type) will be used, so order them from most to least specific.

Example:

```
[openers]
x-scheme-handler/irc=hexchat
x-scheme-handler/http*=firefox
text/html=surf -dfgms
text/plain=gvim {} +125
message/rfc822=thunderbird
```

### HOOKS
Hooks are triggered whenever the associated event occurs. The commands are run in a shell environment with information added to environment variables.

They are configured in the [hooks] section of aerc.conf.

aerc-startup = <command>

Executed when aerc is started is received in the selected folder. If it is used to run certain commands at startup. The hook is executed as soon as the UI is initialized and does not wait for all accounts to be fully loaded. Variables:

•AERC_VERSION

•AERC_BINARY

Example:

aerc-startup = aerc :terminal calcurse && aerc :next-tab

mail-received = <command>

Executed when new mail is received in the selected folder. This will only work reliably with maildir and some imap servers. Variables:

•AERC_FROM_NAME

•AERC_FROM_ADDRESS

•AERC_SUBJECT

Example:

mail-received = notify-send "New mail from $AERC_FROM_NAME" "$AERC_SUBJECT"

aerc-shutdown = <command>

Executed when aerc shuts down. Aerc will wait for the command to finish before exiting. Variables:

•AERC_LIFETIME

## TEMPLATES
Template files are used to populate the body of an email. The :compose, :reply and :forward commands can be called with the -T flag with the name of the template name. The available symbols and functions are described in aerc-templates(7).

aerc ships with some default templates installed in the share directory (usually /usr/share/aerc/templates).

These options are configured in the [templates] section of aerc.conf.

template-dirs = <path1:path2:path3...>

The directory where the templates are stored. The config takes a colon-separated list of dirs. If this is unset or if a template cannot be found, the following paths will be used as a fallback in that order:

```
${XDG_CONFIG_HOME:-~/.config}/aerc/templates
${XDG_DATA_HOME:-~/.local/share}/aerc/templates
/usr/local/share/aerc/templates
/usr/share/aerc/templates
```

new-message = <template_name>

The default template to be used for new messages. Default: new_message

quoted-reply = <template_name>

The default template to be used for quoted replies. Default: quoted_reply

forwards = <template_name>

The default template to be used for forward as body. Default: forward_as_body

## SEE ALSO
aerc(1) aerc-accounts(5) aerc-binds(5) aerc-imap(5) aerc-maildir(5) aerc-notmuch(5) aerc-templates(7) aerc-sendmail(5) aerc-smtp(5) aerc-stylesets(7)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-imap

title: aerc-imap(5)

text:
# aerc-imap(5)

## NAME
aerc-imap - IMAP configuration for aerc(1)

## SYNOPSIS
aerc implements the IMAP protocol as specified by RFC 3501, with the following IMAP extensions:

•IDLE (RFC 2177)

•LIST-STATUS (RFC 5819)

## CONFIGURATION
IMAP configuration may be done interactively with the :new-account command.

In accounts.conf (see aerc-accounts(5)), the following IMAP-specific options are available:

source = <scheme>://<username>[:<password>]@<hostname>[:<port>]?[<oauth2_params>]

Remember that all fields must be URL encoded. The @ symbol, when URL encoded, is %40. Possible values of <scheme> are:

imap

IMAP with STARTTLS

imap+insecure

IMAP without STARTTLS

imaps

IMAP with TLS/SSL

imaps+oauthbearer

IMAP with TLS/SSL using OAUTHBEARER Authentication <oauth2_params>:

If specified and a token_endpoint is provided, the configured password is used as a refresh token to obtain an access token. If token_endpoint is omitted, refresh token exchange is skipped, and the password acts like an access token instead.

•token_endpoint (optional)

•client_id (optional)

•client_secret (optional)

•scope (optional)

Example:

imaps+oauthbearer://...?token_endpoint=https://...&client_id=

imaps+xoauth2

IMAP with TLS/SSL using XOAUTH2 Authentication. Parameters are the same as OAUTHBEARER.

source-cred-cmd = <command>

Specifies the command to run to get the password for the IMAP account. This command will be run using sh -c command. If a password is specified in the source option, the password will take precedence over this command. Example:

source-cred-cmd = pass hostname/username

connection-timeout = <duration>

Maximum delay to establish a connection to the IMAP server. See https://pkg.go.dev/time#ParseDuration. Default: 30s

keepalive-period = <duration>

The interval between the last data packet sent (simple ACKs are not considered data) and the first keepalive probe. After the connection is marked to need keepalive, this counter is not used any further. See https://pkg.go.dev/time#ParseDuration. By default, the system tcp socket settings are used.

keepalive-probes = <int>

The number of unacknowledged probes to send before considering the connection dead and notifying the application layer. By default, the system tcp socket settings are used. If keepalive-period is specified, this option defaults to 3 probes.

This option is only supported on linux. On other platforms, it will be ignored.

keepalive-interval = <duration>

The interval between subsequential keepalive probes, regardless of what the connection has exchanged in the meantime. Fractional seconds are truncated. By default, the system tcp socket settings are used. If keepalive-period is specified, this option defaults to 3s.

This option is only supported on linux. On other platforms, it will be ignored.

check-mail-include = <folder1,folder2,folder3...>

Specifies the comma separated list of folders to include when checking for new mail with :check-mail. Names prefixed with ~ are interpreted as regular expressions. This setting is ignored if your IMAP server supports the LIST-STATUS command, in which case all folders will be checked. By default, all folders are included.

check-mail-exclude = <folder1,folder2,folder3...>

Specifies the comma separated list of folders to exclude when checking for new mail with :check-mail. Names prefixed with ~ are interpreted as regular expressions. This setting is ignored if your IMAP server supports the LIST-STATUS command, in which case all folders will be checked. Note that this overrides anything from check-mail-include. By default, no folders are excluded.

cache-headers = true|false

If set to true, headers will be cached. The cached headers will be stored in $XDG_CACHE_HOME/aerc, which defaults to ~/.cache/aerc. Default: false

cache-max-age = <duration>

Defines the maximum age of cached files. Note: the longest unit of time cache-max-age can be specified in is hours. Set to 0 to disable cleaning the cache Default: 720h (30 days)

idle-timeout = <duration>

The length of time the client will wait for the server to send any final update before the IDLE is closed. Default: 10ms

idle-debounce = <duration>

Specifies the length of time from the last client command until the idler starts. Default: 10ms

## SEE ALSO
aerc(1) aerc-accounts(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-maildir

title: aerc-maildir(5)

text:
# aerc-maildir(5)

## NAME
aerc-maildir - maildir configuration for aerc(1)

## SYNOPSIS
aerc implements the maildir format.

## CONFIGURATION
Maildir accounts currently are not supported with the :new-account command and must be added manually to the accounts.conf file (see aerc-accounts(5)).

The following maildir-specific options are available:

check-mail-cmd = <command>

Command to run in conjunction with check-mail option. Example:

check-mail-cmd = mbsync -a

check-mail-timeout = <duration>

Timeout for the check-mail-cmd. The command will be stopped if it does not complete in this interval and an error will be displayed. Increase from the default if repeated errors occur Default: 10s

source = maildir|maildirpp://<path>

The source indicates the path to the directory containing your maildirs rather than one maildir specifically. The path portion of the URL following maildir:// must be either an absolute path prefixed by / or a path relative to your home directory prefixed with ~. For example:

source = maildir:///home/me/mail source = maildir://~/mail

If your maildir is using the Maildir++ directory layout, you can use the maildirpp:// scheme instead:

source = maildirpp:///home/me/mail source = maildirpp://~/mail

## SEE ALSO
aerc(1) aerc-accounts(5) aerc-smtp(5) aerc-notmuch(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-notmuch

title: aerc-notmuch(5)

text:
# aerc-notmuch(5)

## NAME
aerc-notmuch - notmuch configuration for aerc(1)

## SYNOPSIS
aerc supports using the notmuch email system as a backend, for fast indexing and searching.

For this to be enabled, aerc needs to be build with notmuch support. Refer to the installation instructions for details.

## CONFIGURATION
Notmuch accounts currently are not supported with the :new-account command and must be added manually.

In accounts.conf (see aerc-accounts(5)), the following notmuch-specific options are available:

check-mail-cmd = <command>

Command to run in conjunction with check-mail option. Example:

check-mail-cmd = mbsync -a

check-mail-timeout = <duration>

Timeout for the check-mail-cmd. The command will be stopped if it does not complete in this interval and an error will be displayed. Increase from the default if repeated errors occur Default: 10s

source = notmuch://<path>

The source indicates the path to the directory containing your notmuch database (usually a .notmuch/ folder). The path portion of the URL following notmuch:// must be either an absolute path prefixed by / or a path relative to your home directory prefixed with ~. For example:

source = notmuch:///home/me/mail source = notmuch://~/mail

query-map = <file>

Path to a file containing a mapping from display name to notmuch query in the form of <NAME>=<QUERY>. Multiple entries can be specified, one per line. Lines starting with # are ignored and serve as comments.

e.g. inbox=tag:inbox and not tag:archived

exclude-tags = <tag1,tag2,tag3...>

Comma separated list of tags which will be excluded from query results, unless explicitly mentioned in the query. This can for example be useful if you use an archive or spam tag.

maildir-store = <path>

Path to the maildir store containing the message files backing the notmuch database. This is often the same as the notmuch database path. This is optional. If specified, it will be used by aerc to list available folders and enable commands such as :delete and :archive.

## USAGE
Notmuch shows slightly different behavior than for example imap. Some commands are slightly different in semantics and mentioned below:

cf <notmuch query>

The change folder command allows for arbitrary notmuch queries. Performing a :cf command will perform a new top-level notmuch query.

filter <notmuch query>

The filter command for notmuch backends takes in arbitrary notmuch queries. It applies the query on the set of messages shown in the message list. This can be used to perform successive filters/queries. It is equivalent to performing a set of queries concatenated with "and".

## SEE ALSO
aerc(1) aerc-accounts(5) aerc-smtp(5) aerc-maildir(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-sendmail

title: aerc-sendmail(5)

text:
# aerc-sendmail(5)

## NAME
aerc-sendmail - sendmail configuration for aerc(1)

## SYNOPSIS
aerc can defer to sendmail for the delivery of outgoing messages.

## CONFIGURATION
In accounts.conf (see aerc-accounts(5)), the following sendmail-specific options are available:

outgoing = </path/to/sendmail>

This should be set to the path to the sendmail binary you wish to use, which is generally /usr/sbin/sendmail. aerc will execute it with a list of recipients on the command line and pipe the message to deliver to stdin.

## SEE ALSO
aerc(1) aerc-accounts(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aerc-smtp

title: aerc-smtp(5)

text:
# aerc-smtp(5)

## NAME
aerc-smtp - SMTP configuration for aerc(1)

## SYNOPSIS
aerc implements the SMTP protocol as specified by RFC 5321.

## CONFIGURATION
SMTP configuration may be done interactively with the :new-account command.

In accounts.conf (see aerc-accounts(5)), the following SMTP-specific options are available:

outgoing = <scheme>[+<auth>]://<username>[:<password>]@<hostname>[:<port>]?[<oauth2_params>]

Remember that all fields must be URL encoded. The @ symbol, when URL encoded, is %40. The value of <scheme> can be:

smtp

SMTP with STARTTLS

smtp+insecure

SMTP without STARTTLS

smtps

SMTP with TLS/SSL

Additionally, you can specify an authentication mechanism like so:

none

No authentication is required to use this SMTP server. You may omit the username and password in this case.

plain

Authenticate with a username and password using AUTH PLAIN. This is the default behavior.

login

Authenticate with a username and password using AUTH LOGIN. This is an obsolete protocol, but is required for some common webmail providers.

oauthbearer

SMTP with TLS/SSL using OAUTHBEARER Authentication. See documentation in aerc-imap(5) for usage.

xoauth2

SMTP with TLS/SSL using XOAUTH2 Authentication. See documentation in aerc-imap(5) for usage.

outgoing-cred-cmd = <command>

Specifies the command to run to get the password for the SMTP account. This command will be run using sh -c [command]. If a password is specified in the outgoing option, the password will take precedence over this command. Example:

outgoing-cred-cmd = pass hostname/username

smtp-domain = <domain>

Local domain name to use in the HELO/EHLO SMTP command. Set this to a fully qualified domain name if the server requires it as an antispam measure. Default: localhost

## SEE ALSO
aerc(1) aerc-accounts(5)

## AUTHORS
Originally created by Drew DeVault <sir@cmpwn.com> and maintained by Robin Jarry <robin@jarry.cc> who is assisted by other open source contributors. For more information about aerc development, see https://sr.ht/~rjarry/aerc/.


aide.conf

package: aide

title: aide.conf(5)

text:
# aide.conf(5)

## NAME
aide.conf - The configuration file for Advanced Intrusion Detection Environment

## SYNOPSIS
aide.conf is the configuration file for Advanced Intrusion Detection Environment. aide.conf contains the runtime configuration aide uses to initialize or check the AIDE database.

## FILE FORMAT
aide.conf is case-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line.

AIDE uses the backslash character (\) as escape character for ' ' (space), '@' and '\' (backslash) (e.g. '\ ' or '\@'). To literally match a '\' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\\\').

There are three types of lines in aide.conf. First there are the configuration options which are used to set configuration parameters and define groups. Second, there are (restricted) rules that are used to indicate which files are added to the database. Third, macro lines define or undefine variables within the config file. Lines beginning with # are ignored as comments.

## CONFIG OPTIONS
These lines have the format parameter=value. See URLS for a list of valid urls.

database_in (type: URL, default: see --version output, added in AIDE v0.17)

database (DEPRECATED since AIDE v0.17, will be removed in AIDE v0.19)

The url from which database is read. There can only be one of these lines. If there are multiple database lines then the first is used.

Examples:

```
database_in=file:/var/lib/aide/aide.db
```

Read database locally from /var/lib/aide/aide.db.

```
database_in=stdin
```

Read database from stdin.

```
database_in=https://example.com/aide.db
```

Read database remotely from https://example.com/aide.db.

database_out (type: URL, default: see --version output)

The url to which the new database is written to. There can only be one of these lines. If there are multiple database_out lines then the first is used.

database_new (type: URL, default: <none>)

The url from which the other database for --compare is read.

database_attrs (type: attribute expression, default: H, added in AIDE v0.16)

The attributes of the (uncompressed) database files which are to be added to the reports in report level >= database_attributes . Only checksum attributes are supported. To disable set database_attrs to 'E'.

database_add_metadata (type: bool, default: true, added in AIDE v0.16)

Whether to add the AIDE version and the time of database generation as comments to the database file or not. This option may be set to false by default in a future release.

log_level (type: log level, default: warning, added in AIDE v0.17)

The log level to use. Log messages are written to stderr. If there are multiple log_level lines then the first one is used. The --log-level or -L command line option overwrites this option.

The following log levels are available:

error: show unrecoverable issues that have to be handled by the user. Errors are fatal to the AIDE process. warning: additionally show recoverable issues that most likely lead to unexpected behaviour and should be handled by the user

notice: additionally show recoverable issues that sometimes lead to unexpected behaviour and might be handled by the user.

info: additionally show informational messages

rule: additionally show messages to help to debug the path rule matching

compare: additionally show messages to help to debug file comparison and (special) attribute handling

config: additionally show messages to help to debug config and rule parsing

debug: additionally show messages that are useful to debug the application (very verbose)

thread: additionally show messages about thread processing (e.g. broadcast events)

trace: detailed information about the flow of the application (e.g. in-loop logging) (even more verbose)

verbose (type: number, range: 0 - 255, default: 5, REMOVED in AIDE v0.17)

Removed, use log_level and report_level options instead.

gzip_dbout (type: bool, default: false)

Whether the output to the database is gzipped or not. This option is available only if zlib support is compiled in.

root_prefix (type: path, default: <empty>, added in AIDE v0.16)

The prefix to strip from each file name in the file system before applying the rules and writing to database. AIDE removes a trailing slash from the prefix. If there are multiple root_prefix lines then the first one is used. This option has no effect in compare mode.

acl_no_symlink_follow (type: bool, default: false)

Whether to check ACLs for symlinks or not. This option is available only if acl support is compiled in.

warn_dead_symlinks (type: path, default: false)

Whether to warn about dead symlinks or not.

config_version (type: string, default: <empty>)

The value of config_version is printed in the report and also printed to the database. This is for informational purposes only. It has no other functionality.

config_check_warn_unrestricted_rules (type: bool, default: false, added in AIDE v0.18)

Whether to warn on unrestricted rules during config check. To explicitly define unrestricted rules use 0 (zero) as restriction character.

num_workers (type: number|percentage, default: 1, added in AIDE v0.18)

Specifies the number of simultaneous workers (threads) for file attribute processing (i.a. hashsum calculation). The number of workers can be a positive integer (e.g. '4') or the percentage of the available processors (e.g. '60%'). The resulting number of workers is rounded up to the next integer (e.g. '60%' of 8 processors results in 5 workers).

If there are multiple num_workers lines then the first one is used.

Use 0 (zero) to disable multi-threading.

The default value 1 (single worker thread) may be changed in a future release.

## REPORT OPTIONS
report_url (type: URL, default: stdout)

The URL that the output is written to.

Multiple instances of the report_url option are supported.

Examples:

```
report_url=file:/var/log/aide.log
```

Write report to /var/log/aide.log.

```
report_url=stdout
```

Write report to stdout.

```
report_url=syslog:<LOG_FACILITY>
```

Write report to syslog using LOG_FACILITY.

The following report options are available (to take effect they have to be set before report_url):

report_level (type: report level, default: changed_attributes, added in AIDE v0.17)

The report level to use. The available report levels are as follows:

minimal: print single line whether AIDE found differences to the database summary: additionally print number of added, removed and changed files

database_attributes: additionally print database checksums

list_entries: additionally print lists of added, removed and changed entries

changed_attributes: additionally print details about changed entries

Example:

```
File: /var/lib/apt/extended_states

 Perm      : -rw-r--r--                       | -rw-------

 Uid       : 0                                | 106
```

The left column shows the old value (e.g. from the database_in database) and the right column shows the new value (e.g. from the file system).

added_removed_attributes: additionally print details about added and removed attributes

added_removed_entries: additionally print details about added and removed entries

report_format (type: report format, default: plain, added in AIDE v0.18)

The report format to use. The available report formats are as follows:

plain: Print report in plain human-readable format. json: Print report in json machine-readable format.

report_base16 (type: bool, default: false, added in AIDE v0.17)

Base16 encode the checksums in the report. The default is to report checksums in base64 encoding.

report_detailed_init (type: bool, default: false, added in AIDE v0.16)

Report added files (report level >= list_entries) and their details (report level >= added_removed_entries) in initialization mode.

report_quiet (type: bool, default: false, added in AIDE v0.16)

Suppress report output if no differences to the database have been found.

report_append (type: bool, default: false, added in AIDE v0.17)

Append to the report URL.

report_grouped (type: bool, default: true, added in AIDE v0.17)

grouped (DEPRECATED since AIDE v0.17, will be removed in AIDE v0.19)

Group the files in the report by added, removed and changed files.

report_summarize_changes (type: bool, default: true, added in AIDE v0.17)

summarize_changes (DEPRECATED since AIDE v0.17, will be removed in AIDE v0.19)

Summarize changes in the added, removed and changed files sections of the report. The general format is like the string YlZbpugamcinHAXSEC, where Y is replaced by the file-type ('f' for a regular file, 'd' for a directory, 'l' for a symbolic link, 'c' for a character device, 'b' for a block device, 'p' for a FIFO, 's' for a unix socket, 'D' for a Solaris door, 'P' for a Solaris event port, '!' if file type has changed and '?' otherwise).

The Z is replaced as follows: A '=' means that the size has not changed, a '<' reports a shrinked size and a '>' reports a grown size. The other letters in the string are the actual letters that will be output if the associated attribute for the item has been changed or a '.' for no change.

Otherwise a '+' is shown if the attribute has been added, a '-' if it has been removed, a ':' if the attribute is ignored (but not forced) or a ' ' if the attribute has not been checked.

The exceptions to this are: (1) a newly created file replaces each letter with a '+', and (2) a removed file replaces each letter with a '-'.

The attribute that is associated with each letter is as follows:

o

A l means that the link name has changed.

o

A b means that the block count has changed.

o

A p means that the permissions have changed.

o

An u means that the uid has changed.

o

A g means that the gid has changed.

o

An a means that the access time has changed.

o

A m means that the modification time has changed.

o

A c means that the change time has changed.

o

An i means that the inode has changed.

o

A n means that the link count has changed.

o

A H means that one or more message digests have changed.

The following letters are only available when explicitly enabled using configure:

o

A A means that the access control list has changed.

o

A X means that the extended attributes have changed.

o

A S means that the SELinux attributes have changed.

o

A E means that the file attributes on a second extended file system have changed.

o

A C means that the file capabilities have changed.

report_ignore_added_attrs (type: attribute expression, default: empty, added in AIDE v0.16)

Attributes whose addition is to be ignored in the report.

report_ignore_removed_attrs (type: attribute expression, default: empty, added in AIDE v0.16)

Attributes whose removal is to be ignored in the report.

report_ignore_changed_attrs (type: attribute expression, default: empty, added in AIDE v0.16)

ignore_list (REMOVED in AIDE v0.17)

Attributes whose change is to be ignored in the report.

report_force_attrs (type: attribute expression, default: empty, added in AIDE v0.16)

report_attributes (REMOVED in AIDE v0.17)

Attributes which are always printed in the report for changed files. If an attribute is both ignored and forced the attribute is not considered for file change but printed in the final report as long as the file has been otherwise changed.

report_ignore_e2fsattrs (type: string, default: 0, added in AIDE v0.16)

List (no delimiter) of ext2 file attributes which are to be ignored in the report. See chattr(1) for the available attributes. Use 0 (zero) to not ignore any attribute. Ignored attributes are represented by a ':' in the report. By default AIDE also reports changes of the read-only attributes mentioned in chattr(1) (see example below how to ignore those changes).

Example:

Ignore changes of the read-only ext2 file attributes verify (V), inline data (N), indexed directory (I) and encrypted (E):

```
report_ignore_e2fsattrs=VNIE
```

## GROUPS
Groups are aggregations of attributes.

Group definitions have the format <group name> = <attribute expression>.

Group names are limited to alphanumeric characters (A-Za-z0-9).

See ATTRIBUTES for a description of all available attributes.

Default groups

R

p+ftype+i+l+n+u+g+s+m+c+md5+X

L

p+ftype+i+l+n+u+g+X

>

Growing file p+ftype+l+u+g+i+n+s+growing+X

H

all compiled in hashsums (added in AIDE v0.17)

X

acl+selinux+xattrs+e2fsattrs+caps (if attributes are compiled in, added in AIDE v0.16)

E

Empty group

Use 'aide --version' to list the default compound groups.

## RULES
AIDE supports three types of rules:

Regular rule:

<regex> <attribute expression> Files and directories matching the regular expression are added to the database.

Negative rule:

!<regex> Files and directories matching the regular expression are ignored and not added to the database. The children of matching directories are also ignored.

Equals rule:

=<regex> <attribute expression> Files and directories matching the regular expression are added to the database. The children of directories are only added if the regular expression ends with a "/". The children of sub-directories are not added at all.

Every regular expression has to start with an explicit "/". An implicit ^ is added in front of each regular expression. In other words, the regular expressions are matched at the first position against the complete path. Special characters can be escaped using two-digit URL encoding (for example, %20 to represent a space).

AIDE uses a deepest-match algorithm to find the tree node to search, but a first-match algorithm inside the node. (see also rule log level).

See EXAMPLES for examples.

More in-depth discussion of the selection algorithm can be found in the AIDE manual.

## RESTRICTED RULES
Restricted rules are like normal rules but can be restricted to file types (added in AIDE v0.16). The following file types are supported:

f

restrict rule to regular files

d

restrict rule to directories

l

restrict rule to symbolic links

c

restrict rule to character devices

b

restrict rule to block devices

p

restrict rule to FIFO files

s

restrict rule to UNIX sockets

D

restrict rule to Solaris doors

P

restrict rule to Solaris event ports

0

empty restriction, i.e. don't restrict rule (added in AIDE v0.18)

Multiple restrictions can be given as a comma-separated list.

The syntax of restricted rules is as follows:

Restricted regular rule

<regex> <file types> <attribute expression>

Restricted negative rule

!<regex> <file types>

Restricted equals rule

=<regex> <file types> <attribute expression>

## MACRO LINES
@@define VAR val

Define variable VAR to value val.

@@undef VAR

Undefine variable VAR.

@@if boolean_expression (added in AIDE v0.18)

@@else

@@endif

@@if begins an if statement. It must be terminated with an @@endif statement. The lines between @@if and @@endif are used if the boolean_expression evaluates to true. If there is an @@else statement then the part between @@if and @@else is used if boolean_expression evaluates to true otherwise the part between @@else and @@endif is used.

Available operators and functions in boolean expressions:

```
not boolean_expression
```

Evaluates to true if the boolean_expression is false, and false if the boolean_expression is true.

```
defined VARIABLE
```

Evaluates to true if VARIABLE is defined.

```
hostname HOSTNAME
```

Evaluates to true if HOSTNAME equals the hostname of the machine that AIDE is running on. hostname is the name of the host without the domainname (ie 'hostname', not 'hostname.example.com').

```
exists PATH
```

Evaluates to true if PATH exists.

@@ifdef VARIABLE (DEPRECATED since AIDE v0.18, will be removed in AIDE v0.20)

same as @@if defined VARIABLE

@@ifndef VARIABLE (DEPRECATED since AIDE v0.18, will be removed in AIDE v0.20)

same as @@if not defined VARIABLE

@@ifhost HOSTNAME (DEPRECATED since AIDE v0.18, will be removed in AIDE v0.20)

same as @@if hostname HOSTNAME

@@ifnhost HOSTNAME (DEPRECATED since AIDE v0.18, will be removed in AIDE v0.20)

same as @@if not hostname HOSTNAME

@@{VAR}

@@{VAR} is replaced with the value of the variable VAR. If variable VAR is not defined an empty string is used. Variables are supported in strings and in regular expressions of selection lines.

Pre-defined marco variables:

@@{HOSTNAME}: hostname of the current system

@@include FILE

Include FILE. The content of the file is used as if it were inserted in this part of the config file.

The maximum depth of nested includes is 16.

@@include DIRECTORY REGEX [RULE_PREFIX] (added in AIDE v0.17)

Include all (regular) files found in DIRECTORY matching regular expression REGEX (sub-directories are ignored). The file are included in lexical sort order. If RULE_PREFIX is set, all rules included by the statement are prefixed with given RULE_PREFIX (added in AIDE v0.18). Prefixes from nested include statements are concatenated.

The content of the files is used as if it were inserted in this part of the config file.

@@x_include FILE (added in AIDE v0.17)

@@x_include DIRECTORY REGEX [RULE_PREFIX] (added in AIDE v0.17)

@x_include is identical to @@include, except that if a config file is executable is is run and the output is used as config. If the executable file exits with status greater than zero or writes to stderr aide stops with an error.

For security reasons DIRECTORY and each executable config file must be owned by the current user or root. They must not be group- or world-writable.

@@x_include_setenv VAR VALUE (added in AIDE v0.17)

Adds the variable VAR with the value VALUE to the environment used for config file execution.

Environment variable names are limited to alphanumeric characters (A-Za-z0-9) and the underscore '_' and must not begin with a digit.

## TYPES
bool

Valid values are yes, true, no or false.

attribute expression

An attribute expression is of the following form:

```
  <attribute/group>
| <expr> + <attribute/group>
| <expr> - <attribute/group>
```

URLS

Urls can be one of the following. Input urls cannot be used as outputs and vice versa.

stdout

stderr

Output is sent to stdout, stderr respectively.

stdin

Input is read from stdin.

file:/path

Input is read from path or output is written to path.

fd:number

Input is read from filedescriptor number or output is written to number.

syslog:LOG_FACILITY

Output is written to syslog using LOG_FACILITY.

## ATTRIBUTES
File attributes

ftype

file type (added in AIDE v0.15)

p

permissions

i

inode

l

link name

n

number of links

u

user

g

group

s

size

b

block count

m

mtime

a

atime

c

ctime

acl

access control list (requires libacl)

selinux

selinux attributes (requires libselinux)

xattrs

extended attributes (requires libattr)

e2fsattrs

file attributes on a second extended file system, see also report_ignore_e2fsattrs option (requires libext2fs, added in AIDE v0.15)

caps

file capabilities (requires libcap2, added in AIDE v0.17)

Use 'aide --version' to show which compiled-in attributes are available.

Special attributes

S

check for growing size (DEPRECATED since AIDE v0.18, will be removed in AIDE v0.20) Use growing+s attributes instead

I

ignore changed filename When I is used, the inode of the old file is used to search for a moved file in the new database.

Source and target file have to be located in the same directory and must share the same attributes (except for special attributes ANF, ARF, I, growing, and compressed).

For moved entries a change of the ctime attribute is ignored.

growing

ignore growing file (added in AIDE v0.18) When growing is used, changes of the following attributes are ignored:

size: if new size is greater than old size

bcount: if new bcount is greater than old bcount

atime: if new atime is greater than old atime

mtime: if new mtime is greater than old mtime

ctime: if new ctime is greater than old ctime

hashsums: if the hashsum of the new file restricted to the old size equals the hashsums of the old file

For hashsum attributes the growing attribute is ignored in compare mode.

compressed

ignore compressed file (added in AIDE v0.18) When compressed is used, the uncompressed hashsums of the new compressed file (supported compressions: gzip) are used to search for the uncompressed file in the old database.

The old uncompressed and the new compressed file have to be located in the same directory and must share the same attributes (except for special attributes ANF, ARF, I, growing, and compressed) including at least one hashsum.

Changes of the inode, size, bcount and ctime attributes are ignored.

The growing attribute (i.e. the old file size) is not considered for compressed files during the calculation of the uncompressed hashsums.

The compressed attribute is ignored in compare mode.

ANF

allow new files When 'ANF' is used, new files are added to the new database, but are ignored in the report.

ARF

allow removed files When 'ARF' is used, files missing on disk are omitted from the new database, but are ignored in the report.

Hashsums attributes

md5

MD5 checksum (not in libgcrypt FIPS mode)

sha1

SHA-1 checksum

sha256

SHA-256 checksum

sha512

SHA-512 checksum

rmd160

RIPEMD-160 checksum

tiger

tiger checksum

haval

haval256 checksum (libmhash only)

crc32

crc32 checksum

crc32b

crc32 checksum (libmhash only)

gost

GOST R 34.11-94 checksum

whirlpool

whirlpool checksum

stribog256

GOST R 34.11-2012, 256 bit checksum (libgcrypt only, added in AIDE v0.17)

stribog512

GOST R 34.11-2012, 512 bit checksum (libgcrypt only, added in AIDE v0.17)

Use 'aide --version' to show which hashsums are available.

## EXAMPLES
/ R

This adds all files on your machine to the database. This one line is a fully qualified configuration file.

!/dev$

This ignores the /dev directory structure.

=/foo R

Only /foo and /foobar are taken into the database. None of their children are added.

=/foo/ R

Only /foo and its children (e.g. /foo/file and /foo/directory) are taken into the database. The children of sub-directories (e.g. /foo/directory/bar) are not added.

/ d,f R

Only add directories and files to the database

!/run d

/run R

Add all but directory entries to the database

/run d R-m-c-i

/run R

Use specific rule for directories

Suggested Groups

OwnerMode = p+u+g+ftype

Check permissions, owner, group and file type

Size = s+b

Check size and block count

InodeData = OwnerMode+n+i+Size+l+X

StaticFile = m+c+Checksums

Files that stay static

Full = InodeData+StaticFile

Full = ftype+p+l+u+g+s+m+c+a+i+b+n+H+X

/ 0 Full

This line defines group Full. It has all attributes, all compiled in hashsums (H) and all compiled in extra file attributes (X). See '--version' output for the compiled in hashsums and extra groups. The example rule is the typical catch-all rule at the end of the rule list.

VarTime = InodeData+Checksums

/etc/ssl/certs/ca-certificates\\.crt$ VarTime

Files that change their mtimes or ctimes but not their contents.

VarInode = VarTime-i

/var/lib/nfs/etab$ f VarInode

Files that are recreated regularly but do not change their contents

VarFile = OwnerMode+n+l+X

/etc/resolv\\.conf$ f VarFile

Files that change their contents during system operation

VarDir = OwnerMode+n+i+X

/var/lib/snmp$ d VarDir

Directories that change their contents during system operation

RecreatedDir = OwnerMode+n+X

/run/samba$ d RecreatedDir

Directories that are recreated regularly and change their contents

Log Handling

Logs pose a number of special challenges to AIDE. An active log is nearly constantly being written to. The process of log rotation changes file names for files that are supposed to have unaltered contents. To save space, Logs are compressed in the process of their rotation, and finally, they get deleted. AIDE is supposed to handle all those cases without generating reports, and it is still expected to flag the cases when an attacker tampers with logs.

The following examples suggest a way to handle the common case of log rotation with the logrotate(8) program, with its options compress, delaycompress and nocopytruncate set. The vast majority of logs are rotated this way on most Linux systems.

ActLog=Full+growing+ANF+I

/var/log/foo\\.log$ f ActLog

An Active Log is typically named foo.log. It is constanty being written to. The file does neither change its mode nor its inode number. The size only increases, and what is written to the file is not supposed to change (growing). During log rotation, foo.log is typically renamed to foo.log.1 (or foo.log.0) and the process is instructed to write to a new foo.log. Log content is written to a new file (ANF) and will eventually be renamed to foo.log.1 (I). The growing attribute suppresses reports for files that just had content appended when compared to the database. A change of the old content is still reported!

RotLog=Full

/var/log/foo\\.log\\.1$ f RotLog

foo.log.0 or foo.log.1 is called the Rotated Log, the previously active log renamed to the first name of the Log Series that is formed by the rotation mechanism. Right after rotation, the file might still being written to by the daemon. To aide, this looks like the Active Log's size decreases and its inode and timestamps change. The Rotated Log is not supposed to change its attributes once the process has stopped writing to it. Reports might be generated if aide runs while the process still writes to the Rotated Log, but this is quite unlikely to happen. Some log rotation mechanisms rename foo.log to foo.log.0 to foo.log.1.gz, others rename foo.log to foo.log.1 to foo.2.log.gz.

CompSerLog=Full+I+compressed

/var/log/foo\\.log\\.2\\.gz$ f CompSerLog

In the next rotation step, foo.log.1 gets compressed to foo.log.2.gz, becoming the Compressed Log in the Log Series. With this rule, AIDE does not report this step because it uncompresses the contents of the file and takes the checksum of the uncompressed content. The contents strictly doesn't change, but some attribute changes are ignored (compressed).

MidlSerLog=Full+I

/var/log/foo\\.log\\.[345]\\.gz$ f MidlSerLog

In the next log rotation, all foo.log.{x} get renamed to foo.log.{x+1}. The other attributes are not supposed to change.

LastSerLog=Full+ARF

/var/log/foo\\.log\\.6\\.gz$ f LastSerLog

The configuration of the log rotation process specifies a number of log generations to keep. The last log in the series is therefore removed from the disk (ARF).

aide 0.18 does not yet support the following cases of log rotation:

empty files

It might be the case that a log is actually created, but never written to. This commonly happens on rarely used web servers that use the log rotation as a method to cater for data protection regulation. In result, all files in a series are identical, breaking the heuristics that aide uses to detect log rotation. A possible workaround is to begin a newly rotated log with a timestamp. With logrotate, this can be done in a postrotate scriptlet.

nodelaycompress

With logrotate's nodelaycompress option, a log is immediately compressed after renaming it from the Active Log name. For the time being, it is recommended to always use the delaycompress option to avoid this behavior.

copytruncate

With logrotate's copytruncate option, the Active Log is not renamed and newly created but copied to the new file name. After the copy operation, the old file is truncated to zero size, allowing the daemon to continuously write to the already open file handle. aide uses the Inode number to detect the rotation process. That doesn't work with copytruncate because the Inode stays with the Active Log. For the time being, it is recommended to avoid the copytruncate option to avoid this behavior.

## HINTS
In the following, the first is not allowed in AIDE. Use the latter instead.

/foo epug

/foo e+p+u+g

## SEE ALSO
aide(1)

## DISCLAIMER
All trademarks are the property of their respective owners. No animals were harmed while making this webpage or this piece of software.


ahttpd.acl.conf

package: alterator-fbi

title: ahttpd.acl.conf(5)

summary: ACL configuration file for ahttpd(8).

text:
# ahttpd.acl.conf(5)

## NAME
acl.conf - ACL configuration file for ahttpd(8).

## DESCRIPTION
ahttpd supports simple URL based access control. System administrator (account 'root') has access to all modules. Ordinary users have no access to modules by default but you can create operator accounts with restricted access rights. All settings for such users can be found in this config file.

You can edit this file manually or via system management center web interface.

## FORMAT
Each line is either a comment or a directive. Comment lines start with a # and are ignored. A directive line has the format:

url user1,user2,...

Example:

/a user1

In this case user 'user1' will have access to all URLs with prefix /a, e.g., /a or /a/b.

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
ahttpd(8), ahttpd.conf(5)


ahttpd.conf

title: ahttpd.conf(5)

summary: main configuration file for ahttpd.

text:
# ahttpd.conf(5)

## NAME
ahttpd.conf - main configuration file for ahttpd.

## FORMAT
Each line is either a comment or a directive. Comment lines start with a # and are ignored. A directive line has the format:

option value

Option name is case sensitive.

## OPTIONS
server-listen

IP address where server should listen for incoming connections. Value * means listening to all available interfaces. Default value is *

server-port

TCP port to bind to. Default value is 8080

server-user

Unprivileged user account for server to run as. Standard value is _ahttpd

server-group

Unpriviledged group account for server to run as. Standard value is _ahttpd

server-pidfile

File where server saves its PID. ahttpd uses this file to determine if another copy is running. Standard path is /var/run/ahttpd.pid

server-host

Sometimes server creates a redirect response pointing to itself. There is no way for server to determine its externally known name. Every properly implemented HTTP/1.1 client should send this name as a part of request but it's very useful to have such a fallback. Default value is localhost

server-acl

server supports a simple url based access control. This refers to a configuration file for that. Default value is /etc/ahttpd/acl.conf

server-auth

All clients must be authenticated. Possible values of this parameter are none when authentication is turned off entirely, and session for session based authentication. Please note that in local mode server always turns off authentication. In this mode all users will be authenticated as user 'root'. Default value is session

log-file

Access log file. Server uses this file to write access results for incoming connections. Default path is /var/log/ahttpd/access.log

log-mode

Logging verbosity. Possible values are none (turned off), errors (errors only), and all (log everything). Standard value is errors, default value is none.

tls-key-file

File with server's private SSL key. Server needs this file for HTTPS protocol. Default path is /var/lib/ssl/private/ahttpd.key

tls-cert-file

File with server's public SSL certificate. Server needs this file for HTTPS protocol. Standard path is /var/lib/ssl/certs/ahttpd.cert

framework-uri

Server forms every page as two parts: module part and framework part. Framework part is a common part, e.g., menu. Standard path for System management center framework is /acc

login-uri

Path to login page definition. Standard path for login page is /login

logout-uri

Path to logout page definition. Standard path for logout page is /logout

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
ahttpd(8), ahttpd.acl.conf(8)


anacrontab

package: anacron

title: anacrontab(5)

summary: configuration file for anacron

text:
# anacrontab(5)

## NAME
/etc/anacrontab - configuration file for anacron

## DESCRIPTION
The file /etc/anacrontab describes the jobs controlled by anacron(8). Its lines can be of three kinds: job-description lines, environment assignments, or empty lines.

Job-description lines are of the form:

period delay job-identifier command

The period is specified in days, the delay in minutes. The job-identifier can contain any non-blank character, except slashes. It is used to identify the job in Anacron messages, and as the name for the job's timestamp file. The command can be any shell command.

Environment assignment lines are of the form:

VAR = VALUE

Spaces around VAR are removed. No spaces around VALUE are allowed (unless you want them to be part of the value). The assignment takes effect from the next line to the end of the file, or to the next assignment of the same variable.

Empty lines are either blank lines, line containing white-space only, or lines with white-space followed by a '#' followed by an arbitrary comment.

## SEE ALSO
anacron(8)

The Anacron README file.

## AUTHOR
Itai Tzur <itzur@actcom.co.il>


and.conf

package: and

title: and.conf(5)

text:
# and.conf(5)

## NAME
/etc/and/and.conf - general configuration parameters for the auto nice daemon.

## VERSION
This manual page documents and.conf for and version 1.2.2.

## DESCRIPTION
This is the general configuration file for and. It stores settings like the default nice level, the renice intervals, the three stages of renicing, and the affinity of the priority database, i.e. the weight of (user, group, command) when resolving nice levels from the database. These settings are described below.

Comments start with a # in the first column. Empty lines are ignored. Unlike with other configuration files, lines cannot be concatenated with a backslash. Furthermore, this file is case sensitive.

and allows for host-specific sections in the configuration file. These work as lines of the form on somehost and work as follows: the parser determines if the host name (as returned by gethostname) matches the extended regular expression that follows the on keyword. If it does, it just keeps processing the file as if nothing had happened. If it does not match, however, everything up to the next on keyword is skipped. So if you want to end a host-specific section, you must write on .* (which matches all hosts) to switch back to normal.

Don't forget to kill -HUP the auto nice daemon to enable the changes.

## SETTINGS
defaultnice

The default nice level. A number between 0 and 19. Jobs for which no entry can be found in /etc/and/and.priorities are reniced to this level, regardless of the CPU time they've used so far. If you prefer to renice unknown jobs gradually, you can do so by supplying three asterisks as (user, group, command) tuple in /etc/and/and.priorities. The default nice level is 0

interval

The default interval between nice checks of the auto nice daemon, in seconds. This value can be overridden by the -i command-line option of and. The default interval is 60 seconds.

lv1time

lv2time

lv3time

Ranges for the nice levels. Jobs with less than lv1time seconds CPU time are not reniced; jobs between lv1time and lv2time seconds are reniced to the first level in an.priorities; jobs between lv2time and lv3time seconds to the second level; jobs with more than lv3time seconds are reniced to the third level. Defaults are 120 , 1200 , and 3600 seconds.

minuid, mingid

Minimum user id and group id to be considered for renicing. Processes whose user id is below minuid are left alone, as are processes with a group id of below mingid. (Note that even if you set minuid to zero, root processes are left alone.)

affinity

Strategy for picking the right priority entry for a user/group/job triple. The strategy is a permutation of "cgu", "c"ommand, "g"roup, "u"ser. The order specifies the affinity of the priority lookup method. Suppose you have an entry for all jobs of user foo, another entry for all jobs of group bar, and yet another entry for the command baz. Furthermore suppose user foo (who happens to belong to group bar ) starts a job named baz -- which entry should be chosen? This is what the affinity setting means, for example "cug" means an exact match of the command has priority over both an exact match of the user and the group. The default affinity is "cug", which is probably sensible for most cases, since it's the job which takes up CPU time, not the user or group ID.

## EXAMPLES
Default Configuration

\# This is the default configuration:

defaultnice 0

interval 60

lv1time 300

lv2time 1800

lv3time 3600

affinity cug

minuid 0

mingid 0

Default Configuration, with terminals

\# Normal default configuration for all

defaultnice 0

interval 60

lv1time 300

lv2time 1800

lv3time 3600

\# Hosts foo, bar, baz are terminals and must

\# be more responsive, so earlier renice.

on (foo|bar)

lv1time 120

lv2time 600

lv3time 1200

on .*

\# This is for all hosts again

affinity cug

Group-specific Hosts

defaultnice 0

interval 60

lv1time 300

lv2time 1800

lv3time 3600

\# Normal affinity for all hosts.

affinity cug

\# Hosts bar, baz belong to group foo, which

\# is privilegued on these hosts, so override

\# affinity. (Note regexp!)

on ba[rz]

affinity guc

on .*

minuid 500

mingid 100

## FILES
/etc/and.conf

General configuration file. Stores default nice level, default interval, the "time zones" and the database lookup affinity. This is what this manual page is about.

## SEE ALSO
and(8), and.priorities(5), kill(1), regex(7), renice(8)

## INTERNET
http://and.sourceforge.net/

## AUTHOR
The auto nice daemon and this manual page were written by Patrick Schemitz <schemitz@users.sourceforge.net>


and.priorities

title: and.priorities(5)

text:
# and.priorities(5)

## NAME
/etc/and/and.priorities - priority database for the auto nice daemon.

## VERSION
This manual page documents and.priorities for and version 1.2.2.

## DESCRIPTION
This is the priority database file for and. It stores (user, group, command, parent, nicelevels) tuples (hereafter called entries) to determine the new nice level (or the kill signal, for that matter) when a job reaches one of the time limits defined in /etc/and/and.conf. (See lv1time, lv2time, and lv3time on the and.conf manual page for details.) See the affinity setting in /etc/and/and.conf for how ambiguities between the fields (user, group, command, parent) are dealt with when searching the database to determine the new nice level for a job. Note that if more than one entry matches with the same accuracy (e.g. with a parent= entry and an ancestor= entry), the last entry wins!

Comments start with a # in the first column. Empty lines are ignored. Unlike with other configuration files, lines cannot be concatenated with a backslash. Furthermore, this file is case sensitive.

and allows for host-specific sections in the configuration file. These work as lines of the form on somehost and work as follows: the parser determines if the host name (as returned by gethostname) matches the extended regular expression that follows the on keyword. If it does, it just keeps processing the file as if nothing had happened. If it does not match, however, everything up to the next on keyword is skipped. So if you want to end a host-specific section, you must write on .* (which matches all hosts) to switch back to normal.

Don't forget to kill -HUP the auto nice daemon to enable the changes.

## SETTINGS
A valid entry consists of a line of six columns, separated by one or more spaces. These columns are: (in that order)

user

The user ID the command is running under. May be a user name (which will be looked up in the password file and, if enabled, via NIS), or a numeric user ID, or an asterisk for any user.

group

The group ID the command is running under. May be a group name (which will be looked up in the group file and again, if enabled, via NIS), or a numeric group ID, or an asterisk for any group.

command

The name of the command, without path. May be a command, a regular expression to match multiple commands, or an asterisk for any command. Note that "foobar" will not match "/usr/bin/foobar" - you probably mean ".*foobar" or even ".*foobar.*".

parent

There are two modes of operation for the parent field, determined by a keyword: parent=foobar will match if a process' direct parent process matches the command or regular expression after the equal sign, whereas ancestor=foobar will match if any ancestor process matches. After the keyword and the equal sign goes the name of the parent process, without path. May be a command, a regular expression to match multiple commands, or an asterisk for any command. (You can just use the asterisk if you want to ignore parents for this entry.) Note that again "foobar" will not match "/usr/bin/foobar", as with command.

nicelevel 1

The nice level after lv1time CPU time was used by the command. Positive numbers and 0 are interpreted as nice levels; negative numbers are interpreted as signals to be sent to the command. A "nice level" of 19 will almost stop the job, -9 will actually kill it. (Like in kill -9.) lv1time can be set in /etc/and.conf

nicelevel 2

Same but after lv2time.

nicelevel 3

Same but after lv3time.

## EXAMPLES
Here are some entries from the real world (i.e. from "my" cluster at the Institute). As lv[123]time, 5 min., 20 min., and 1 hour is assumed. (Which is the default. See /etc/and.conf for details.) You might also check the default priority database that comes with and.

\# A finer default nice level

* * * * 4 8 12

\# User dau is an idiot, so treat him like accordingly

dau * * * 19 19 19

\# Netscape sometimes goes berserk, we must stop it

* * netscape * 4 -9 -9

\# Most hosts are free for everyone but some are

\# especially for the FOO group

* * * * 4 8 12

on (bar|baz)

* * * * 8 12 16

\# ... or, more radical: * * * * -9 -9 -9

* foo * * 4 8 12

on .*

\# KDE screen savers...

* * .*kss * 16 16 16

\# Grid jobs (assuming they are started by a master

\# process)

* * * ancestor=grid_master 10 10 10

\# Now some clever yet deceitful user might start all

\# his jobs using a shell script named grid_master.

\# He shall regret... whereas the original grid_master

\# (owned by grid) is left alone.

* * grid_master * -9 -9 -9

grid * grid_master * 0 0 0

## FILES
/etc/and/and.priorities

The priority database (in plain text). Contains the (user, group, command, nicelevels) tuples. This is what this manual page is about.

## SEE ALSO
and(8), and.conf(5), kill(1), regex(7), renice(8)

## INTERNET
http://and.sourceforge.net/

## AUTHOR
The auto nice daemon and this manual page were written by Patrick Schemitz <schemitz@users.sourceforge.net>